EP1588535B1 - Aufbau von kommunikationstunnel - Google Patents

Aufbau von kommunikationstunnel Download PDF

Info

Publication number
EP1588535B1
EP1588535B1 EP04704303A EP04704303A EP1588535B1 EP 1588535 B1 EP1588535 B1 EP 1588535B1 EP 04704303 A EP04704303 A EP 04704303A EP 04704303 A EP04704303 A EP 04704303A EP 1588535 B1 EP1588535 B1 EP 1588535B1
Authority
EP
European Patent Office
Prior art keywords
tunnel
network
node
networks
tunnel control
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP04704303A
Other languages
English (en)
French (fr)
Other versions
EP1588535A1 (de
Inventor
Ram Gopal Lakshmi Narayanan
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nokia Oyj
Nokia Inc
Original Assignee
Nokia Oyj
Nokia Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nokia Oyj, Nokia Inc filed Critical Nokia Oyj
Publication of EP1588535A1 publication Critical patent/EP1588535A1/de
Application granted granted Critical
Publication of EP1588535B1 publication Critical patent/EP1588535B1/de
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2212/00—Encapsulation of packets
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/04—Network layer protocols, e.g. mobile IP [Internet Protocol]

Definitions

  • This invention relates to establishing communication tunnels. It is particularly applicable to establishing secure tunnels, for example IPsec tunnels through VPN (Virtual Private Network) gateways
  • IPsec IP Security Associations
  • VPNs are often used to connect intranets or to form an extranet over the Internet.
  • VPN tunnels are normally implemented as IPsec sessions: a VPN endpoint, based on the security policy, acts on the plain IP traffic and applies confidentiality (ESP, encapsulating security payload) or integrity (AH, authentication header).
  • ESP confidentiality
  • AH integrity
  • the receiving security gateway performs the reverse process.
  • IPsec is a receiver-oriented operation, meaning that the receiving end should have all the necessary knowledge of how to decrypt the packet and what keys are to be used to decrypt and validate against the policy. All this information has to be in place beforehand at the receiving tunnel endpoint and this is either done manually or by using IKE (internet key exchange).
  • FIG. 1 There are generally two ways in which an IPsec link can be implemented. These are illustrated in figure 1 .
  • a client terminal 1 establishes the IPsec link directly between itself and a remote terminal 2 over an intervening network 3, which is generally a public network such as the internet.
  • the client terminal connects to a security gateway (SG) 5 through a local network 4, and the security gateway establishes the IPsec link between itself and the remote terminal 2.
  • the security gateway may have pre-established the IPsec link.
  • the terminal 1 needs to know the address of the security gateway 5 so that it can connect to it.
  • the terminal 1 may establish a secure communication session with the security gateway, especially if the network 4 is insecure.
  • Method A is often known as a "road warrior" set-up.
  • Method B is generally used for interconnecting corporate local area networks over an intervening public network such as the Internet.
  • the client terminal 1 In method A the client terminal 1 must support the processing to terminate the IPsec link. It may use either pre-shared secret keys or perform IKE (internet key exchange) to establish the session keys. This requires a considerable amount of processing power, and whilst it is suitable for devices such as laptop personal computers, it is generally unsuitable for devices such as mobile phones, PDAs (personal digital assistant) and other small portable devices that typically have less processing capacity, less memory and less battery storage. Such devices may have problems supporting VPN client applications; or it may not be possible for such devices to use many IPsec sessions to perform host-to-host or host-to-network VPN tunnels.
  • IKE Internet key exchange
  • IPsec is used to provide remote access to a corporate network, which could be represented by or located behind remote terminal 2.
  • the VPN client application software is either pre-programmed into the client terminal (for method A), or the client terminal is made aware of the address of the security gateway (for method B). As indicated above, trust can be pre-established between the security gateway and the remote terminal 2 (which could be another security gateway).
  • Most corporate access systems provide their own VPN application to run on the client for providing remote access, using method A.
  • a user of such system launches and connects to the nearest (or indeed any available) remote security gateway (equivalent to remote terminal 2) in order to gain access to the cooperate network.
  • remote security gateway equivalent to remote terminal 2
  • This may not possible for small hand held devices like mobile phone, PDAs and other portable equipment due to their limited processing, memory and energy storage capabilities.
  • FIG. 2 shows a scenario where a VPN tunnel using IPsec has been established over a 3G UMTS/W-CDMA network.
  • a mobile node (MN) 10 is currently corresponding with a correspondent node (CN) 11.
  • the MN is attached to an autonomous system (AS) AS1.
  • the AS1 may be a wireless local area network (LAN) or an extranet or another network.
  • the CN is part of another autonomous system, AS6, and further autonomous systems AS2 are also provided.
  • AS1, AS2 and AS 6 are here acting as stub autonomous systems and AS3 form a transit network.
  • VPN tunnel 12 established between security gateway SG-1 in AS1 and security gateway SG-3 in AS6. That tunnel may be either pre-established or created specific for a certain session between the MN and the CN. Now, if the MN switches from AS-1 to AS-2, for example because MN physically moves from the coverage area of AS1 to the coverage area of AS2, the previous security associations may not be valid, and new security associations may have to be re-established from SG-2 of AS2 to SG-3 of AS6. This requires additional signalling, and may involve re-establishing the whole session between the MN and the CN.
  • AS1 could tunnel all the relevant packets all the way to the MN, but this is likely to cause additional overhead in processing the IP packets at the MN; and would involve a route of AS2-AS1-AS6, which is clearly non-optimal and wastes both bandwidth and processing power of the MN and the security gateway.
  • Another problem that can arise for mobile nodes is that when a mobile node is turned on it does not know where it is, and so it does not know the address of the nearest security gateway.
  • Tunnel endpoint discovery partially addresses these problems as it proposes that there is a pre-established trust relationship between the two endpoint security gateways or that the security gateway nearer to the remote node somehow knows the pre-established security policy and can perform IKE to establish the security association.
  • the proposal cited above does not indicate how security policies with respect to the remote node can be added to the security gateway. The proposal might work for manually configured security gateways, but it would not scale well for IP mobility solutions.
  • ESP encapsulating security payload
  • AH authentication header
  • a method for establishing a secure communications tunnel between a first node and a second node in a communication system including a plurality of networks each having a respective tunnel control entity for controlling establishment of secure communications tunnels in the respective network, the first node operating in a first one of the networks and the second node operating in a second one of the networks; the method comprising: determining a route for the communications tunnel from the first node to the second network by way of one or more of the other networks; forming a request message digitally signed by the first node and including the identities of the tunnel control entity of the first network and the tunnel control entities of the said other networks; and transmitting the request message to the tunnel control entity of the second network; and in response to that message establishing the secure communication tunnel between the first node and the second node by way of the tunnel control entities identified in that message.
  • IP Mobility Support for IPv4 by C. Perkins discloses a method for providing IP mobility.
  • Mobile nodes are identified by their home address. If a mobile node moves out of its home network, then the mobile node is associated with a care-of-address, which the mobile node registers with its home agent. This allows the home agent to intercept messages for the mobile node and forward them to the care-of address with which the mobile node is currently associated.
  • the tunnel control entity of the second network stores for the duration of the tunnel the identities of the tunnel control entities identified in the message.
  • the communication system includes a key server that stores a secure communication key for each of the tunnel control entities, wherefrom the tunnel control entity of the second network may retrieve a secure communication key for any of the tunnel control entities identified in the message, and thereby establish a secure communication tunnel to that entity.
  • the step of determining a route may comprise repeatedly: forming and digitally signing at the first node a request message requesting establishment of a secure communications tunnel from the first node to the second node and including the identity of each tunnel control entity that has transmitted its identity to the first node in a previous iteration of these steps; transmitting the request message from the first node to one of the tunnel control entities identified in the message; determining at the said one of the tunnel control entities another of the networks that is on a communication path from the network that has the said one of the tunnel control entities to the network in which the second node is operating; transmitting from the said one of the tunnel control entities to the tunnel control entity of the other of the networks a message indicating the request for establishment of a secure communications tunnel from the first node to the second node; and transmitting from the tunnel control entity of the other of the networks to the first node the identity of that tunnel control entity.
  • the method may comprise forming and digitally signing at the first node a request message requesting establishment of a secure communications tunnel from the first node to the second node and including the identify of a tunnel control entity; transmitting the request message from the first node to the tunnel control entity identified in the message; and determining at the tunnel control entity that receives the request message another of the networks that is on a communication path from the network that has that tunnel control entity to the network in which the second node is operating; modifying the request message at the tunnel control entity by appending the identity of the tunnel control entity to the request message and digitally signing the request message; and forwarding the modified request message to the next hop towards the second node by transmitting the modified request message from the tunnel control entity to the tunnel control entity of the other of the networks.
  • the method comprises: detecting that the first node has been or is to be handed over from the first network to a third one of the networks; informing the tunnel control entity of the third network of the communication tunnel from the first node to the second node; and determining a route for the communications tunnel from the third network to the second network by way of one or more of the other networks.
  • the first network is a local area network, most preferably a wireless local area network.
  • at least one of the networks on the route from the first network to the second network is a UMTS/3G network.
  • the or each request message may be a message having its router alert option set.
  • the first node may be a wireless communication terminal.
  • the tunnel may be a virtual private network tunnel.
  • the tunnel may be secured using the IPsec protocol.
  • a communication system including a plurality of networks each having a respective tunnel control entity for controlling establishment of secure communications tunnels in the respective network, a first node operating in a first one of the networks and a second node operating in a second one of the networks; the communication system being capable of supporting a secure communications tunnel between the first node and the second node, and comprising: means for determining a route of the communications tunnel from the first network to the second network by way of one or more of the other networks; means for forming a request message digitally signed by the first node and including the identities of the tunnel control entity of the first network and the tunnel control entities of the said other networks; and means for transmitting the request message to the tunnel control entity of the second network; and means for, in response to that message establishing the secure communication tunnel between the first node and the second node by way of the tunnel control entities identified in that message.
  • a tunnel control entity for controlling establishment of secure communications tunnels in a network comprised in a communication system including a plurality of networks, the tunnel control entity being arranged to: in response to receiving from another entity a request for establishment of a communication tunnel by way of the said network, transmit to the other entity the identity of the tunnel control entity; and in response to receiving a request for establishment of a communication tunnel from the said network to another network of the communication system, determine a route for the communications tunnel from the said network to the other network by way of one or more of the other networks included in the communication system.
  • FIG. 3 shows a communication system that includes a plurality of networks AS1-AS6.
  • the networks act as autonomous subsystems of an overall communication system.
  • Each network includes a security gateway SG1-6, which has among its functions the control of secure communication tunnels running to and from (and therefore also through) the network.
  • the security gateway can therefore act as a tunnel control unit.
  • a mobile node 20, which in this example is a wireless communication terminal, is in communication with the network AS2.
  • the mobile node can move to the coverage of other ones of the networks, such as network AS1, in which case it may be handed over to such an other network.
  • Network AS6 includes a correspondent node CN.
  • the mobile node (MN 20) wishes to establish a secure communications tunnel to the CN.
  • One example of such a situation is if the mobile node wishes to establish a VPN connection to the CN.
  • This case relates to a situation where an MN is turned on and then requires a VPN tunnel to access its corporate network.
  • the AAA (access, authentication and accounting) unit 21 of AS2 and the policy server PS2 of AS2 are informed about the MN's profile.
  • the MN is currently attached to an access router AR of AS2 - this is a conventional access router which does not perform any security gateway functions.
  • the MN now requires a VPN tunnel to access its corporate network AS6.
  • the MN has to first discover the security gateway most convenient to AR and should designate that as one of the tunnel endpoints. This involves the following steps:
  • SA security association
  • the SG in the AS to which the MN was attached before handover can forward data (e.g. in a packet) to the SG in the AS to which the MN is handed over (“new SG”) (or to that AS itself).
  • That data can include details of a tunnel that has already been established from the MN to a CN, and using that data the new SG can perform SG discovery on behalf of the MN. That data should include an indication that the tunnel exists from the MN, and an identification of the other endpoint of the tunnel.
  • the new SG can establish a tunnel from itself to the other endpoint without intervention from the MN.
  • the CN will receive the "SG-ENDPOINT-MESSAGE" from the new SG and can consequently update its bindings for the tunnel to the MN. Having done so the CN will start using the newly set-up route and send the packets directly to the new SG. Until then the packets carried over the tunnel may be tunnelled through the old SG without using the new route.
  • the above method may make use of the IPsec opportunistic mechanism described in "A method for doing opportunistic encryption with IKE", draft-richardson-ipsec-opportunistic-06.txt , IETF, Feb 2002, M. Richardson, et al., the router alert option described in "IP Router Alert Option", RFC 2113, IETF, February 1997, D. Katz and may make use of BGP (border gateway protocol) AS (autonomous system) numbering path information to establish the security association between corporate security gateway and another other security gateway in the internet.
  • BGP border gateway protocol
  • AS autonomous system
  • the discovery of a suitable SG may occur when the node is turned on, or at another time, for example when it comes into communication range of the AS, or when a tunnel is to be established.
  • the present invention can be used outside the environments described above.
  • the end-points need not communicate over a publicly accessible network such as the Internet.
  • Different protocols can be used for transporting the data and securing the tunnel.
  • Neither of the end-points needs to be mobile, although as indicated above the system is especially advantageous when applied to mobile systems.
  • an endpoint is mobile, it is preferably capable of communicating with its local autonomous network by wireless means, for example by radio or infrared.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Near-Field Transmission Systems (AREA)
  • Radio Relay Systems (AREA)

Claims (15)

  1. Verfahren zum Aufbau eines sicheren Kommunikationstunnels zwischen einem ersten Knoten (MN) und einem zweiten Knoten (CN) in einem Kommunikationssystem umfassend mehrere Netzwerke (AS1-ASG) mit jeweils einer entsprechenden Tunnelsteuerungseinheit (SG1-SG5) zum Steuern des Aufbaus sicherer Kommunikationstunnels in dem entsprechenden Netzwerk, wobei der erste Knoten in einem ersten Netzwerk operiert und der zweite Knoten in einem zweiten Netzwerk operiert; wobei das Verfahren gekennzeichnet ist durch:
    Bestimmen einer Route für den Kommunikationstunnel vom ersten Netzwerk zum zweiten Netzwerk über eines oder mehrere der anderen Netzwerke;
    Erzeugen einer Anfragenachricht, die vom ersten Knoten digital signiert ist und die Identitäten der Tunnelsteuerungseinheit des ersten Netzwerks und der Tunnelsteuerungseinheiten der anderen Netzwerke beinhaltet; und
    Übermitteln der Anfragenachricht an die Tunnelsteuerungseinheit des zweiten Netzwerks; und
    in Antwort auf diese Nachricht: Aufbauen des sicheren Kommunikationstunnels zwischen dem ersten Knoten und dem zweiten Knoten mittels der in dieser Nachricht identifizierten Tunnelsteuerungseinheiten.
  2. Verfahren nach Anspruch 1, bei dem die Tunnelsteuerungseinheit (SG-3) des zweiten Netzwerks (AS-6) für die Dauer des Tunnels die Identitäten der in der Nachricht identifizierten Tunnelsteuerungseinheiten speichert.
  3. Verfahren nach einem der vorstehenden Ansprüche, bei dem das Kommunikationssystem einen Schlüssel-Server aufweist, der für jede der Tunnelsteuerungseinheiten einen sicheren Kommunikationsschlüssel speichert ausgehend von dem die Tunnelsteuerungseinheit des zweiten Netzwerks einen sicheren Kommunikationsschlüssel für jede der in der Nachricht identifizierten Tunnelsteuerungseinheiten ableiten kann, und dadurch einen sicheren Kommunikationstunnel zu dieser Einheit aufbauen kann.
  4. Verfahren nach einem der vorstehenden Ansprüche, bei dem der Schritt des Bestimmens einer Route in Wiederholung umfasst:
    Erzeugen und digitales Signieren einer Anfragenachricht am ersten Knoten, die den Aufbau eines sicheren Kommunikationstunnels vom ersten Knoten zum zweiten Knoten beantragt und die Identitäten jener Tunnelsteuerungseinheiten beinhaltet, die ihre Identität in einer vorherigen Iteration dieser Schritte zum ersten Knoten übermittelt haben;
    Übermitteln der Anfragenachricht vom ersten Knoten zu einer der in der Nachricht identifizierten Tunnelsteuerungseinheiten;
    bei dieser einen Tunnelsteuerungseinheit: Bestimmen eines anderen Netzwerks, das auf dem Kommunikationspfad vom ersten Netzwerk, das diese eine Tunnelsteuerungseinheit aufweist, zu dem Netzwerk, in dem der zweite Knoten operiert, liegt;
    Übermitteln einer Nachricht von der einen Tunnelsteuerungseinheit zu der Tunnelsteuerungseinheit des anderen Netzwerks, wobei die Nachricht die Anfrage zum Aufbau eines sicheren Kommunikationstunnels vom ersten Knoten zum zweiten Knoten anzeigt; und
    Übermitteln der Identität dieser Tunnelsteuerungseinheit von der Tunnelsteuerungseinheit des anderen Netzwerks zum ersten Knoten.
  5. Verfahren nach einem der Ansprüche 1 bis 3, bei dem das Verfahren umfasst:
    Erzeugen und digitales Signieren einer Anfragenachricht beim ersten Knoten, wobei die Anfragenachricht den Aufbau eines sicheren Kommunikationstunnels vom ersten Knoten zum zweiten Knoten beantragt und die Identität einer Tunnelsteuerungseinheit beinhaltet;
    Übermitteln der Anfragenachricht vom ersten Knoten zu der in der Nachricht identifizierten Tunnelsteuerungseinheit;
    bei der Tunnelsteuerungseinheit, welche die Anfragenachricht empfängt: Bestimmen eines anderen Netzwerks, das auf einem Kommunikationspfad von dem Netzwerk, das diese Tunnelsteuerungseinheit aufweist, zu dem Netzwerk, in dem der zweite Knoten operiert, liegt;
    Modifizieren der Anfragenachricht bei der Tunnelsteuerungseinheit durch Anhängen der Identität der Tunnelsteuerungseinheit an die Anfragenachricht und digitales Signieren der Anfragenachricht; und
    Weiterleiten der modifizierten Anfragenachricht zum nächsten Sprung in Richtung des zweiten Knotens durch Übermitteln der modifizierten Anfragenachricht von der Tunnelsteuerungseinheit zu der Tunnelsteuerungseinheit des anderen Netzwerks.
  6. Verfahren nach einem der vorstehenden Ansprüche umfassend:
    Detektieren, dass der erste Knoten vom ersten Netzwerk zu einem dritten Netzwerk übergeben wurde oder übergeben werden soll;
    Informieren der Tunnelsteuerungseinheit des dritten Netzwerks über den Kommunikationstunnel vom ersten Knoten zum zweiten Knoten; und
    Bestimmen einer Route für den Kommunikationstunnel vom dritten Netzwerk zum zweiten Netzwerk über eines oder mehrere der anderen Netzwerke.
  7. Verfahren nach einem der vorstehenden Ansprüche, bei dem das erste Netzwerk ein lokales Netzwerk (LAN) ist.
  8. Verfahren nach Anspruch 7, bei dem das erste Netzwerk ein drahtloses lokales Netzwerk (WLAN) ist.
  9. Verfahren nach einem der vorstehenden Ansprüche, bei dem wenigstens eines der Netzwerke auf der Route vom ersten Netzwerk zum zweiten Netzwerk ein UMTS/3G-Netzwerk ist.
  10. Verfahren nach einem der vorstehenden Ansprüche, bei dem die oder alle Anfragenachrichten eine Nachricht mit Router-Alert-Set ist bzw. sind.
  11. Verfahren nach einem der vorstehenden Ansprüche, bei dem der ersten Knoten ein drahtloses Telekommunikationsendgerät ist.
  12. Verfahren nach einem der vorstehenden Ansprüche, bei dem der Tunnel ein Tunnel eines virtuellen privaten Netzwerks (VPN) ist.
  13. Verfahren nach einem der vorstehenden Ansprüche, bei dem der Tunnel mittels des IPsec-Protokolls gesichert wird.
  14. Kommunikationssystem umfassend mehrere Netzwerke (AS1-AS6), die jeweils eine entsprechende Tunnelsteuerungseinheit (SG1-SG5) zum Steuern des Aufbaus sicherer Kommunikationstunnels in dem jeweiligen Netzwerk aufweisen, sowie einen ersten Knoten (MN), der in einem ersten Netzwerk (AS2) operiert, und einen zweiten Knoten (CN), der in einem zweiten Netzwerk (AS6) operiert; wobei das Kommunikationssystem in der Lage ist, einen sicheren Kommunikationstunnel zwischen dem ersten und dem zweiten Knoten aufzubauen, und dadurch gekennzeichnet ist, dass es umfasst:
    Mittel zum Bestimmen einer Route für den Kommunikationstunnel vom ersten Netzwerk zum zweiten Netzwerk über eines oder mehrere der anderen Netzwerke;
    Mittel zum Erzeugen einer Anfragenachricht, die vom ersten Knoten digital signiert ist und die Identitäten der Tunnelsteuerungseinheit des ersten Netzwerks und der Tunnelsteuerungseinheiten der anderen Netzwerke beinhaltet; und
    Mittel zum Übermitteln der Anfragenachricht an die Tunnelsteuerungseinheit des zweiten Netzwerks; und
    Mittel um in Antwort auf diese Nachricht den sicheren Kommunikationstunnel zwischen dem ersten Knoten und dem zweiten Knoten mittels der in dieser Nachricht identifizierten Tunnelsteuerungseinheiten aufzubauen.
  15. Tunnelsteuerungseinheit (SG1-SG5) zum Steuern des Aufbaus sicherer Kommunikationstunnels in einem Netzwerk, das in einem mehrere Netzwerke umfassenden Kommunikationssystem enthalten ist, wobei die Tunnelsteuerungseinheit ausgelegt ist um:
    in Antwort auf den Empfang einer Anfrage zum Aufbau eines Kommunikationstunnels über das Netzwerk von einer anderen Einheit: die Identität der Tunnelsteuerungseinheit zu der anderen Einheit zu übertragen; und
    in Antwort auf den Empfang einer Nachricht zum Aufbau eines Kommunikationstunnels vom Netzwerk zu einem anderen Netzwerk des Kommunikationssystems: eine Route für den Kommunikationstunnel vom Netzwerk zu dem anderen Netzwerk über eines oder mehrere der anderen in dem Kommunikationssystem (AS1-AS6) enthalten Netzwerke zu bestimmen.
EP04704303A 2003-01-24 2004-01-22 Aufbau von kommunikationstunnel Expired - Lifetime EP1588535B1 (de)

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
US44206203P 2003-01-24 2003-01-24
US442062P 2003-01-24
US637648 2003-08-11
US10/637,648 US7779152B2 (en) 2003-01-24 2003-08-11 Establishing communication tunnels
PCT/IB2004/000215 WO2004066582A1 (en) 2003-01-24 2004-01-22 Establishing communication tunnels

Publications (2)

Publication Number Publication Date
EP1588535A1 EP1588535A1 (de) 2005-10-26
EP1588535B1 true EP1588535B1 (de) 2008-07-02

Family

ID=32738377

Family Applications (1)

Application Number Title Priority Date Filing Date
EP04704303A Expired - Lifetime EP1588535B1 (de) 2003-01-24 2004-01-22 Aufbau von kommunikationstunnel

Country Status (5)

Country Link
US (1) US7779152B2 (de)
EP (1) EP1588535B1 (de)
AT (1) ATE400129T1 (de)
DE (1) DE602004014721D1 (de)
WO (1) WO2004066582A1 (de)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8811397B2 (en) 2010-02-16 2014-08-19 Ncp Engineering Gmbh System and method for data communication between a user terminal and a gateway via a network node

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7478427B2 (en) * 2003-05-05 2009-01-13 Alcatel-Lucent Usa Inc. Method and apparatus for providing adaptive VPN to enable different security levels in virtual private networks (VPNs)
US7649866B2 (en) * 2003-06-24 2010-01-19 Tropos Networks, Inc. Method of subnet roaming within a network
US7788480B2 (en) * 2003-11-05 2010-08-31 Cisco Technology, Inc. Protected dynamic provisioning of credentials
US20050120213A1 (en) * 2003-12-01 2005-06-02 Cisco Technology, Inc. System and method for provisioning and authenticating via a network
JP3937096B2 (ja) * 2004-01-30 2007-06-27 松下電器産業株式会社 通信システム、アクセス装置及びトンネル通信管理方法
KR20060009676A (ko) * 2004-07-26 2006-02-01 삼성전자주식회사 자동으로 터널을 설정하는 방법 및 장치
US8316434B2 (en) * 2005-02-23 2012-11-20 At&T Intellectual Property I, L.P. Centralized access control system and methods for distributed broadband access points
US8700800B2 (en) * 2006-02-15 2014-04-15 Tropos Networks, Inc. Roaming of clients between gateways of clusters of a wireless mesh network
GB0608385D0 (en) 2006-04-27 2006-06-07 Nokia Corp Communications in relay networks
US8171541B2 (en) * 2007-12-18 2012-05-01 Nokia Corporation Enabling provider network inter-working with mobile access
KR101146139B1 (ko) * 2008-12-22 2012-05-16 한국전자통신연구원 패킷 전송 네트워크에서의 단말의 이동성 제공 방법 및 패킷 전송 네트워크 시스템, 게이트웨이 스위치
EP2494814B1 (de) * 2009-10-27 2015-12-23 Telefonaktiebolaget L M Ericsson (PUBL) Verfahren und vorrichtung zum austausch von daten zwischen einem benutzergerät und einem kernnetzwerk über ein sicherheits-gateway
US8601569B2 (en) 2010-04-09 2013-12-03 International Business Machines Corporation Secure access to a private network through a public wireless network
US8396871B2 (en) 2011-01-26 2013-03-12 DiscoverReady LLC Document classification and characterization
US8762706B2 (en) 2011-04-11 2014-06-24 International Business Machines Corporation Computer systems, methods and program product for multi-level communications
US9667514B1 (en) 2012-01-30 2017-05-30 DiscoverReady LLC Electronic discovery system with statistical sampling
US10467252B1 (en) 2012-01-30 2019-11-05 DiscoverReady LLC Document classification and characterization using human judgment, tiered similarity analysis and language/concept analysis
CN104104569B (zh) * 2013-04-01 2017-08-29 华为技术有限公司 建立vpn隧道的方法及服务器
WO2015137855A1 (en) * 2014-03-13 2015-09-17 Telefonaktiebolaget L M Ericsson (Publ) Establishment of secure connections between radio access nodes of a wireless network
CN106878177B (zh) * 2016-12-30 2020-01-03 新华三技术有限公司 一种路由处理方法及装置
US11258694B2 (en) * 2017-01-04 2022-02-22 Cisco Technology, Inc. Providing dynamic routing updates in field area network deployment using Internet Key Exchange v2
CN110324159B (zh) 2018-03-28 2020-11-03 华为技术有限公司 链路配置方法、控制器和存储介质
US11936629B2 (en) * 2018-06-21 2024-03-19 VMware LLC System and method for creating a secure hybrid overlay network
CN110391984B (zh) * 2019-07-26 2022-01-25 新华三大数据技术有限公司 一种报文转发方法及装置
CN116074038B (zh) * 2022-11-29 2023-08-22 杭州海兴电力科技股份有限公司 一种用于IPv6数据安全传输的网关系统及方法

Family Cites Families (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2268374A (en) * 1992-06-23 1994-01-05 Ibm Network addressing
NL9401142A (nl) * 1994-07-11 1996-02-01 Nederland Ptt Overdracht van berichten via verschillende subnetwerken.
US6101543A (en) * 1996-10-25 2000-08-08 Digital Equipment Corporation Pseudo network adapter for frame capture, encapsulation and encryption
US6189039B1 (en) * 1997-04-10 2001-02-13 International Business Machines Corporation Selective tunneling of streaming data
US6556584B1 (en) * 1998-04-06 2003-04-29 Motorola, Inc. System and method of communicating non-standardized addresses over a standardized carrier network
US6751729B1 (en) * 1998-07-24 2004-06-15 Spatial Adventures, Inc. Automated operation and security system for virtual private networks
US6571289B1 (en) * 1998-08-03 2003-05-27 Sun Microsystems, Inc. Chained registrations for mobile IP
US6651105B1 (en) * 1998-11-12 2003-11-18 International Business Machines Corporation Method for seamless networking support for mobile devices using serial communications
US6711147B1 (en) * 1999-04-01 2004-03-23 Nortel Networks Limited Merged packet service and mobile internet protocol
FI991597A7 (fi) 1999-07-12 2001-01-13 Nokia Corp Access-kontekstin hallinta makrotason liikkuvuudenhallintarekisteröinnin yhteydessä access-verkoissa
AU2001257306A1 (en) * 2000-04-27 2001-11-07 Fortress Technologies, Inc. A method and apparatus for integrating tunneling protocols with standard routingprotocols
US6574214B1 (en) * 2000-05-25 2003-06-03 Nortel Networks Limited Reduced overhead tunneling techniques in a communications network having mobile foreign agents
US6760330B2 (en) * 2000-12-18 2004-07-06 Sun Microsystems, Inc. Community separation control in a multi-community node
US7155518B2 (en) * 2001-01-08 2006-12-26 Interactive People Unplugged Ab Extranet workgroup formation across multiple mobile virtual private networks
US20030005328A1 (en) * 2001-06-29 2003-01-02 Karanvir Grewal Dynamic configuration of IPSec tunnels
US7827292B2 (en) * 2001-07-23 2010-11-02 At&T Intellectual Property Ii, L.P. Flexible automated connection to virtual private networks
US20030140223A1 (en) * 2002-01-23 2003-07-24 Robert Desideri Automatic configuration of devices for secure network communication
US6954435B2 (en) * 2002-04-29 2005-10-11 Harris Corporation Determining quality of service (QoS) routing for mobile ad hoc networks
US7159242B2 (en) * 2002-05-09 2007-01-02 International Business Machines Corporation Secure IPsec tunnels with a background system accessible via a gateway implementing NAT
US7583632B2 (en) * 2002-05-28 2009-09-01 Nortel Networks Limited Efficient handoffs between cellular and wireless local area networks
JP4056849B2 (ja) * 2002-08-09 2008-03-05 富士通株式会社 仮想閉域網システム
US20040047308A1 (en) * 2002-08-16 2004-03-11 Alan Kavanagh Secure signature in GPRS tunnelling protocol (GTP)
JP4063024B2 (ja) * 2002-09-13 2008-03-19 三菱電機株式会社 分散ＭｏｂｉｌｅＩＰによる移動管理方式
US7062566B2 (en) * 2002-10-24 2006-06-13 3Com Corporation System and method for using virtual local area network tags with a virtual private network

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8811397B2 (en) 2010-02-16 2014-08-19 Ncp Engineering Gmbh System and method for data communication between a user terminal and a gateway via a network node

Also Published As

Publication number Publication date
ATE400129T1 (de) 2008-07-15
DE602004014721D1 (de) 2008-08-14
WO2004066582A1 (en) 2004-08-05
US20040148430A1 (en) 2004-07-29
EP1588535A1 (de) 2005-10-26
US7779152B2 (en) 2010-08-17

Similar Documents

Publication Publication Date Title
EP1588535B1 (de) Aufbau von kommunikationstunnel
US7380124B1 (en) Security transmission protocol for a mobility IP network
US7929528B2 (en) System and method to support networking functions for mobile hosts that access multiple networks
US6839338B1 (en) Method to provide dynamic internet protocol security policy service
US7174018B1 (en) Security framework for an IP mobility system using variable-based security associations and broker redirection
EP1524799B1 (de) Funkinformationsübertragungssystem, Funkkommunikationsverfahren und Funkendgeräteeinrichtung
EP1463257B1 (de) Kommunikation zwischen einem privatem Netzwerk und einem mobilem Endgerät
US7861080B2 (en) Packet communication system
EP1774750B1 (de) Verfahren, Vorrichtungen und computerlesbares Medium zum Aufbau sicherer Ende-zu-Ende-Verbindungen mittels Verbindung von IPSec Security Associations
US8514851B2 (en) Mobile IPv6 authentication and authorization baseline
CN1817013B (zh) 终端和通信系统
US8732816B2 (en) Method and apparatus for exchanging data between a user equipment and a core network via a security gateway
JP4913909B2 (ja) モバイルｉｐネットワークにおけるルート最適化
US20060111113A1 (en) Virtual private network with mobile nodes
US20050195780A1 (en) IP mobility in mobile telecommunications system
US20020147820A1 (en) Method for implementing IP security in mobile IP networks
US7804826B1 (en) Mobile IP over VPN communication protocol
US8499097B1 (en) Mobile route optimization authorization
US7933253B2 (en) Return routability optimisation
US20090106831A1 (en) IPsec GRE TUNNEL IN SPLIT ASN-CSN SCENARIO
US20250311025A1 (en) Methods and Apparatus Supporting User Equipment (UE) Access to a Core Network Via a Wireless Local Area Network (WLAN) and Facilitating Transfer of Application Data via the Core Network
Byoung-Jo et al. Simple mobility support for IPsec tunnel mode

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20050607

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL LT LV MK

DAX Request for extension of the european patent (deleted)
17Q First examination report despatched

Effective date: 20060505

RIN1 Information on inventor provided before grant (corrected)

Inventor name: NARAYANAN, RAM, GOPAL, LAKSHMI

17Q First examination report despatched

Effective date: 20060505

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REF Corresponds to:

Ref document number: 602004014721

Country of ref document: DE

Date of ref document: 20080814

Kind code of ref document: P

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

NLV1 Nl: lapsed or annulled due to failure to fulfill the requirements of art. 29p and 29m of the patents act
PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081013

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081202

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081002

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

26N No opposition filed

Effective date: 20090403

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090131

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20090122

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090131

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090131

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20090113

Year of fee payment: 6

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090122

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081002

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090122

REG Reference to a national code

Ref country code: FR

Ref legal event code: ST

Effective date: 20100930

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081003

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20100201

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090122

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090103

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080702

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20170125

Year of fee payment: 14

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 602004014721

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180801